Watch ·
Bulletin for Wednesday, September 30, 2026
Every morning, what just entered the two registers, and what to do about it. Advisories are grouped by update: one line, one action.
+10breaches, in 6 sectors+22advisories, in 16 updates1actively exploited14Maccounts affected, as reported
Deal with these first
Exploited · OS
Apple Multiple ProductsApply the vendor’s patch.
Critical · 6.6M accounts
Times CarChange that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
CVSS 9.1 · PyPI
PyJWT5 failles · fixed in 2.14.0
pip install --upgrade "PyJWT>=2.14.0"
Today’s breaches 10
Transport and travel2
Telecoms2
Retail2
Healthcare2
Nonprofits1
Digital services1
Today’s advisories 22
Apple Multiple ProductsOS · Exploitedvendor patch
- CVE-2026-86950Remote code executionCritical
PyJWTPyPI · CVSS 9.1 · 5 failles→ 2.14.0
pip install --upgrade "PyJWT>=2.14.0"- CVE-2026-102268Cryptographic weakness · CVSS 9.1 · <= 2.13.0Critical
- CVE-2026-102266Cryptographic weakness · CVSS 7.4 · >= 2.13.0, < 2.14.0High
- CVE-2026-102267Server-side request forgery · CVSS 7.4 · <= 2.13.0High
- CVE-2026-102272Cryptographic weakness · CVSS 7.4 · = 2.13.0High
- CVE-2026-102273Cryptographic weakness · CVSS 7.4 · = 2.13.0High
@xhmikosr/decompressnpm · CVSS 9.1→ 11.1.4
npm install @xhmikosr/decompress@11.1.4- CVE-2026-101894Path traversal · CVSS 9.1 · >= 11.0.0, <= 11.1.3Critical
phpcsstandards/phpcsutilsComposer · CVSS 8.6→ 1.2.3
composer require "phpcsstandards/phpcsutils:>=1.2.3"- CVE-2026-65954Remote code execution · CVSS 8.6 · >= 1.0.0-alpha1, < 1.2.3High
electronnpm · CVSS 8.3 · 2 failles→ 41.10.6
npm install electron@41.10.6- CVE-2026-102676Privilege escalation · CVSS 8.3 · < 41.10.6High
- CVE-2026-102674Privilege escalation · CVSS 8.2 · < 41.10.6High
electronnpm · CVSS 8.2→ 41.10.4
npm install electron@41.10.4- CVE-2026-102673Other · CVSS 8.2 · < 41.10.4High
electronnpm · CVSS 7.8→ 42.10.0
npm install electron@42.10.0- CVE-2026-102677Other · CVSS 7.8 · >= 42.3.3, < 42.10.0High
adm-zipnpm · CVSS 7.5 · 2 failles→ 0.6.1
npm install adm-zip@0.6.1- GHSA-8238-w5pm-2374Denial of service · CVSS 7.5 · <= 0.6.0High
- CVE-2026-92000Denial of service · CVSS 7.5 · <= 0.6.0High
@nestjs/microservicesnpm · CVSS 7.5→ 11.2.4
npm install @nestjs/microservices@11.2.4- CVE-2026-102281Denial of service · CVSS 7.5 · < 11.2.4High
brace-expansionnpm · CVSS 7.5→ 5.0.10
npm install brace-expansion@5.0.10- CVE-2026-102276Denial of service · CVSS 7.5 · >= 4.0.0, < 5.0.10High
brace-expansionnpm · CVSS 7.5→ 5.0.11
npm install brace-expansion@5.0.11- CVE-2026-102278Denial of service · CVSS 7.5 · >= 4.0.0, < 5.0.11High
engine.ionpm · CVSS 7.5→ 6.6.10
npm install engine.io@6.6.10- CVE-2026-102599Denial of service · CVSS 7.5 · >= 6.6.0, < 6.6.10High
joinpm · CVSS 7.5→ 17.13.7
npm install joi@17.13.7- CVE-2026-92599Denial of service · CVSS 7.5 · >= 17.2.0, < 17.13.7High
nodemailernpm · CVSS 7.5→ 10.0.6
npm install nodemailer@10.0.6- CVE-2026-100700Denial of service · CVSS 7.5 · <= 10.0.5High
undicinpm · CVSS 7.5→ 6.28.1
npm install undici@6.28.1- CVE-2026-19534Denial of service · CVSS 7.5 · >= 6.7.0, < 6.28.1High
pyjwtPyPI · CVSS 7.4→ 2.14.0
pip install --upgrade "pyjwt>=2.14.0"- CVE-2026-102271Cryptographic weakness · CVSS 7.4 · >= 2.4.0, < 2.14.0High
Get the bulletin every morning
The same content, no ads, no tracking: priorities, breaches by sector, advisories by update with the command to copy.
An entry joins the bulletin on the day it reaches the site, not on the date of the advisory or the disclosure: a flaw GitHub published last night is in this morning’s bulletin.